A retailer's data center lease ends in 90 days. Facilities found a cheaper building beside a river with one power feed and wants to sign in two weeks. No site assessment exists. What should the security architect do FIRST? A. Require a second power feed in the lease terms B. Assess the site for natural and physical threats before signing C. Design flood barriers and raised floors into the fit-out D. Transfer the flood and outage risk through insurance (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

After a ransomware scare, a manufacturer's board funded zero trust. The network team wants an access broker deployed this quarter, but no inventory of applications, data flows or trust boundaries exists. What should the security manager do FIRST? A. Deploy the access broker for remote users first B. Map the applications, data flows and trust boundaries C. Segment the network by department before the rollout D. Pilot the access broker on executive devices (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A retailer's marketing team wants 200,000 prospect emails from a data broker for next week's launch. The prospects fall under several privacy regimes and nobody knows how consent was obtained. What should the security manager do FIRST? A. Require a data processing agreement from the broker B. Have legal confirm a lawful basis for using the list C. Review the broker's security certifications and audits D. Add an opt-out link to every campaign message (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A security consultant discovers her client is knowingly misrepresenting remediation status to its customers after an assessment she performed. The client cites confidentiality clauses in her contract and directs her to stay silent. Under the ISC2 Code of Ethics, what is her PRIMARY obligation? A. Honor the confidentiality agreement with the client B. Act honorably and protect the public trust C. Report the misrepresentation to affected customers D. Withdraw from the engagement and document concerns (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A new CISO inherits a mature control environment but finds no documented risk assessments supporting it. Leadership considers the controls sufficient and resists spending on analysis. What should the CISO do FIRST? A. Conduct a risk assessment to align controls with business risk B. Benchmark the control set against an industry framework C. Present leadership a business case for the assessment budget D. Continue operations while documenting controls retroactively (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!