A bank acquired a fintech and wants both networks joined in 30 days so staff can share systems. The fintech network is flat, runs legacy protocols and was never assessed. What should the security manager do FIRST? A. Deploy a default-deny firewall between the networks B. Assess the fintech network and define trust boundaries C. Segment the fintech network and retire legacy protocols D. Route cross-network traffic through the bank's monitored proxy (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A law firm signed a contract for an offshore vendor to label 50,000 client documents for AI training, starting Monday. The documents are classified Confidential and the handling standard bars external transfer. What should the security manager do FIRST? A. Require the vendor to sign a confidentiality agreement B. Have the data owner rule on reclassification or a documented exception C. Redact client identifiers before any transfer D. Encrypt the transfer and the vendor's storage (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

I am pleased to share that I passed the CISM exam on my second attempt last night! I couldn’t clear the exam on my first attempt, missing the passing score by just 9 points (441 against the required 450). Having passed the CISSP exam on my first attempt, I was perhaps overconfident and appeared for CISM without adequate preparation. That experience taught me an important lesson: success in one certification does not guarantee success in another, as each exam requires a different mindset and preparation strategy. In my experience, the CISM mindset is somewhat different from that of the CISSP. CISM places greater emphasis on information security governance, risk management, and aligning security with business objectives, rather than focusing primarily on technical security controls. My preparation resources included: - CISM Exam App by Vincent — special thanks to Mr. Vincent for this valuable resource. - Destination Certification CISM App - CISM Review Manual and old QB available to me in book form. - Selected CISM videos by Parab, Peter Zerger, and the 100 CISM Questions video. Interestingly, only around 10–15% of the questions seemed familiar from my first attempt. My experience suggests that the CISM question bank is dynamic, with a different mix of questions appearing in each exam. Therefore, relying on memorization alone is not a reliable strategy; understanding the concepts and developing the right CISM mindset are essential. My key takeaway: Prepare thoroughly, focus on governance and risk management, understand the reasoning behind the answers, and never underestimate the exam.

A retailer's data center lease ends in 90 days. Facilities found a cheaper building beside a river with one power feed and wants to sign in two weeks. No site assessment exists. What should the security architect do FIRST? A. Require a second power feed in the lease terms B. Assess the site for natural and physical threats before signing C. Design flood barriers and raised floors into the fit-out D. Transfer the flood and outage risk through insurance (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital audit finds nurses who moved to billing still hold clinical record access. HR never tells IT about role changes, and the CIO wants an identity governance platform bought this quarter. What should the security manager do FIRST? A. Buy the identity governance platform to automate access reviews B. Revoke clinical access from all billing staff today C. Define a mover process with HR as the authoritative source D. Recertify every department's access in a one-time review (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!