An insurer will replace its claims system with a small vendor's package in 60 days. The vendor keeps admin access for support and has never shown how it tests its code. No acquisition security requirements exist. What should the security manager do FIRST? A. Require a current penetration test report from the vendor B. Define acquisition security requirements and assess the vendor's development practices C. Put the vendor's admin access behind a privileged access gateway D. Scan the delivered package for vulnerabilities before deployment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Effective April 15, 2027, the updated CISSP exam outline will go live. You can review it now in multiple languages: - Scott Baale, CEO ISC2 - https://www.linkedin.com/posts/scottbeale_one-of-the-things-i-appreciate-most-about-activity-7516556869344137216-eFfY?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAlSp8kBaIoXyD70ddXWOegK6MRRibWkhcE 🔗 https://lnkd.in/gCtKEzsq

A law firm signed a contract for an offshore vendor to label 50,000 client documents for AI training, starting Monday. The documents are classified Confidential and the handling standard bars external transfer. What should the security manager do FIRST? A. Require the vendor to sign a confidentiality agreement B. Have the data owner rule on reclassification or a documented exception C. Redact client identifiers before any transfer D. Encrypt the transfer and the vendor's storage (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A SaaS firm's largest customer requires an independent penetration test before renewing in 30 days. The CTO wants the in-house red team to do it, and sales wants only the customer portal tested. What should the security manager do FIRST? A. Have the in-house red team test now to hit the deadline B. Agree scope and independence criteria with the customer C. Hire an external firm to test only the customer portal D. Run a vulnerability scan before any penetration test (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A logistics firm's developers source a third of new code, including payment logic shipping in two weeks, from an AI coding assistant. The coding standard and review gates never mention assistant output. What should the security manager do FIRST? A. Run static analysis on the AI-written code B. Suspend the assistant pending vendor security review C. Extend the coding standard and review gates to assistant output D. Require developers to tag every assistant-written change (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!