During a confirmed ransomware incident, the IR team identifies that the attacker is still actively exfiltrating data through a compromised service account. The legal team requests that no systems be taken offline to preserve evidence for potential litigation. Operations wants the bleeding stopped immediately. What should the incident commander prioritize FIRST? A. Disable the compromised service account to stop active data exfiltration B. Isolate affected network segments while preserving system state for forensics C. Initiate a full forensic image of all affected systems before any containment action D. Convene an emergency meeting with legal, operations, and security to align on priorities Come back for the answer tomorrow, or study more now!

A remote workforce uses split-tunnel VPN to reduce bandwidth costs. The security team discovers employees are accessing sanctioned SaaS applications directly from home networks, bypassing the corporate proxy and DLP controls. Management values the current performance gains. What is the MOST appropriate recommendation? A. Switch to full-tunnel VPN to route all traffic through corporate controls B. Deploy a cloud-based secure web gateway to enforce policy at the endpoint C. Accept the risk and document the DLP gap as a known exception D. Restrict SaaS access to corporate-managed devices only Come back for the answer tomorrow, or study more now!

Your organization is migrating legacy on-premises applications to a multi-cloud environment. The security team discovers that several applications use hardcoded service account credentials that cannot be easily refactored before the migration deadline. Business leadership refuses to delay the timeline. What is the BEST approach? A. Migrate as planned and prioritize credential refactoring in the next sprint B. Implement secrets management and network segmentation around the vulnerable applications C. Present the risk formally to leadership with compensating control options and timeline impacts D. Reject the migration for applications with hardcoded credentials until remediation is complete Come back for the answer tomorrow, or study more now!

During a third-party risk assessment, you discover a critical SaaS vendor stores customer data in a jurisdiction that conflicts with your organization's data residency requirements. The vendor scores well on every other security benchmark. The contract renewal deadline is in two weeks. What should you do FIRST? A. Require the vendor to migrate data to a compliant region before renewal B. Engage legal counsel to assess regulatory exposure and contractual options C. Renew the contract with an addendum requiring future data residency compliance D. Begin evaluating alternative vendors that meet data residency requirements Come back for the answer tomorrow, or study more now!

A multinational organization is migrating its data to a third-party cloud provider. The Chief Information Security Officer (CISO) is concerned about maintaining compliance with various international privacy regulations. What is the BEST way to ensure the cloud provider meets the organization’s security requirements? - A. Conduct a point-in-time vulnerability scan of the provider’s infrastructure. - B. Include "right-to-audit" clauses and Require Service Level Agreements (SLAs). - C. Review the provider’s SOC 2 Type II report and audit results. - D. Implement a Cloud Access Security Broker (CASB) to monitor traffic.