A law firm signed a contract for an offshore vendor to label 50,000 client documents for AI training, starting Monday. The documents are classified Confidential and the handling standard bars external transfer. What should the security manager do FIRST? A. Require the vendor to sign a confidentiality agreement B. Have the data owner rule on reclassification or a documented exception C. Redact client identifiers before any transfer D. Encrypt the transfer and the vendor's storage (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A retailer's data center lease ends in 90 days. Facilities found a cheaper building beside a river with one power feed and wants to sign in two weeks. No site assessment exists. What should the security architect do FIRST? A. Require a second power feed in the lease terms B. Assess the site for natural and physical threats before signing C. Design flood barriers and raised floors into the fit-out D. Transfer the flood and outage risk through insurance (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital audit finds nurses who moved to billing still hold clinical record access. HR never tells IT about role changes, and the CIO wants an identity governance platform bought this quarter. What should the security manager do FIRST? A. Buy the identity governance platform to automate access reviews B. Revoke clinical access from all billing staff today C. Define a mover process with HR as the authoritative source D. Recertify every department's access in a one-time review (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A regional bank's outsourced SOC closes most alerts as false positives, and analysts now mute noisy rules to hit response targets before a regulator exam next month. What should the security operations manager do FIRST? A. Tune the noisy rules to cut false positives B. Assess which muted rules covered risks the bank must detect C. Add analyst headcount to meet targets without muting D. Reinstate every muted rule before the exam (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital's new scanner reports 4,000 findings. The CIO wants a board dashboard next month showing risk falling, and operations wants to patch by severity score alone. What should the security manager do FIRST? A. Patch every critical and high finding immediately B. Validate findings and map them to asset criticality and owners C. Build the dashboard from scanner severity counts D. Rescan monthly to chart open findings (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!