An organization replaces periodic vulnerability scans with a continuous exposure-management platform that automatically adjusts risk scores based on real-time threat intelligence. During an internal audit, leadership asks whether this approach still satisfies regulatory expectations for formal security assessments. What should the security manager do FIRST to address this concern? A. Map continuous monitoring outputs to regulatory assessment requirements B. Resume scheduled vulnerability scans to avoid audit findings C. Request written approval from regulators for the new approach D. Disable automated risk scoring and rely on static assessments

An enterprise discovers that a widely used third-party monitoring agent embedded in multiple production servers has begun making undocumented outbound connections to an IP range controlled by a subcontractor the enterprise has never engaged. The agent is critical for operational visibility, and disabling it would blind several detection controls. No malicious activity has been confirmed, but threat intelligence reports suggest recent supply chain compromises involving similar agents. What should the security manager do FIRST? A. Immediately isolate all hosts running the agent from the network B. Conduct a rapid supplier risk reassessment and verify the legitimacy of the subcontractor relationship C. Disable the agent across production to eliminate potential exfiltration D. Escalate directly to regulators due to potential third-party data exposure

A breach exposes encrypted personal data. The encryption keys are stored securely and were not compromised. Under GDPR, what is the most accurate interpretation regarding breach notification to the supervisory authority? A. Notification is always required, regardless of encryption B. Notification is not required because the data is encrypted C. Notification is required only if there is a high risk to rights and freedoms D. Notification is required only if the data subjects complain