Your organization completes a data classification initiative and discovers that 40% of data labeled "confidential" has not been accessed in over three years. Storage costs are significant. Data owners across business units cannot confirm whether retention requirements still apply. What should you recommend FIRST? A. Archive the dormant data to lower-cost storage with existing classification labels B. Conduct a retention review with data owners and legal to validate regulatory obligations C. Declassify the unused data to reduce protection overhead and storage costs D. Implement automated data lifecycle policies to purge data exceeding retention thresholds Come back for the answer tomorrow, or study more now!

A newly acquired subsidiary uses a separate identity provider with no federation to the parent company. Executives want immediate single sign-on access to the subsidiary's financial reporting system. The subsidiary's IT team warns their directory contains orphaned accounts from prior layoffs. What should you address FIRST? A. Establish federated trust between both identity providers B. Perform an access review and remove orphaned accounts in the subsidiary's directory C. Provision executive accounts directly in the subsidiary's identity provider D. Implement multi-factor authentication on the financial reporting system Come back for the answer tomorrow, or study more now!

Your organization deploys an AI assistant with access to internal knowledge bases containing data classified at multiple sensitivity levels. The system currently returns results regardless of the requestor's clearance level. No access enforcement layer exists between the AI and the data. What is the PRIMARY risk? A. The AI model may retain sensitive data in its context and leak it to subsequent users B. Unauthorized information disclosure through the AI bypassing established access controls C. Excessive query logging creating a secondary repository of classified information D. Users developing over-reliance on AI responses instead of consulting original sources Come back for the answer tomorrow, or study more now!

An organization's CISO discovers that a third-party SaaS vendor processing customer PII has been acquired by a foreign company. The acquiring company is headquartered in a jurisdiction with government data access laws that conflict with the organization's regulatory obligations under GDPR. The vendor contract has 18 months remaining. What should the CISO do FIRST? A. Invoke the contract's termination-for-convenience clause and begin immediate vendor transition planning B. Conduct a risk assessment to evaluate the change in data sovereignty exposure and regulatory compliance impact C. Require the vendor to migrate all customer data to data centers located within approved jurisdictions D. Notify the Data Protection Authority and affected customers of the potential cross-border data transfer Come back for the answer tomorrow, or study more now!

A financial institution uses continuous control monitoring to support regulatory examinations. During a supervisory review, regulators challenge whether reported control effectiveness constitutes “reasonable assurance,” given that testing criteria, thresholds, and exception handling are defined by the same team operating the controls. Leadership wants defensible assurance without dismantling automation. What is the MOST appropriate action to take NEXT? A. Rotate control owners periodically to reduce familiarity bias B. Establish independent assurance criteria and validation over monitoring logic C. Increase sampling depth and testing frequency across automated controls D. Supplement dashboards with annual external audit attestations Come back for the answer tomorrow, or study more now!