An organization integrates automated security testing into its CI/CD pipeline. Shortly after deployment, build times increase significantly, and developers begin bypassing security checks to meet release deadlines. Senior management is concerned about both security and delivery velocity. What should the security lead do FIRST? A. Disable automated security testing to restore build speed B. Tune and prioritize security tests based on risk and criticality C. Enforce strict policy violations and discipline developers D. Move security testing entirely to post-deployment monitoring

An organization adopts a Zero Trust model and removes implicit trust between internal network segments. Shortly after deployment, several business-critical applications experience latency and intermittent access failures. Leadership questions whether the Zero Trust initiative should be rolled back. What should the security architect do FIRST? A. Roll back Zero Trust controls to restore application performance B. Perform a targeted assessment to identify policy enforcement points causing disruption C. Permanently whitelist affected applications to bypass Zero Trust controls D. Escalate the issue to vendors to redesign the Zero Trust architecture

An organization migrating legacy file shares to a cloud collaboration platform discovers that several datasets contain regulated records with no documented retention periods or data owners. The business wants immediate migration to meet a project deadline. What should the security manager do FIRST? A. Migrate the data and address ownership and retention after cutover B. Identify data owners and define retention requirements before migration C. Apply default retention policies to all datasets to avoid delay D. Escalate the issue to legal and halt the migration indefinitely

A global enterprise is transitioning from long-term symmetric encryption keys to an automated key rotation system using hardware security modules (HSMs). During the rollout, application owners express concern that frequent rotation may disrupt legacy integrations and availability. What should the security architect do FIRST? A. Enforce the new key-rotation policy across all systems immediately B. Perform a risk assessment to evaluate availability impact and integration dependencies C. Allow legacy systems to retain long-term keys indefinitely D. Delay implementation until all applications are modernized

An enterprise discovers that a widely used third-party monitoring agent embedded in multiple production servers has begun making undocumented outbound connections to an IP range controlled by a subcontractor the enterprise has never engaged. The agent is critical for operational visibility, and disabling it would blind several detection controls. No malicious activity has been confirmed, but threat intelligence reports suggest recent supply chain compromises involving similar agents. What should the security manager do FIRST? A. Immediately isolate all hosts running the agent from the network B. Conduct a rapid supplier risk reassessment and verify the legitimacy of the subcontractor relationship C. Disable the agent across production to eliminate potential exfiltration D. Escalate directly to regulators due to potential third-party data exposure