A manufacturer buys a smaller rival in 30 days. The CEO wants its network joined to the corporate cloud on day one. Its security posture has never been reviewed. What should the security manager do FIRST? A. Connect it behind a restrictive firewall B. Require it to adopt corporate security policies C. Perform security due diligence on its environment D. Extend cyber insurance to cover its systems (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A shipping app relies on an open source library whose only maintainer went silent a year ago. A critical flaw is now public and release is in two weeks. Developers want to fork and patch it. What should the security manager do FIRST? A. Approve the fork to keep the release on schedule B. Assess the library's exposure and the alternatives to forking C. Require a software bill of materials for the app D. Block the exploit at the gateway as a compensating control (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A retailer must move 200 stores to a cloud point of sale over internet links in 60 days. The network team proposes an encrypted overlay so stores cut over as circuits arrive. What should the security manager do FIRST? A. Approve the overlay to keep cutovers on schedule B. Identify the data flows and requirements the design must meet C. Require multifactor authentication on every store tunnel D. Commission a penetration test before the first cutover (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital must move its imaging platform to a public cloud within 90 days; design approval is due next week. The architect proposes provider managed encryption at rest for every workload. What should the security manager do FIRST? A. Approve the design to protect the contract deadline B. Confirm data classification and the shared responsibility split C. Require customer managed keys in a hardware security module D. Schedule a penetration test of the platform before go live (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A lender will embed a third party AI model in loan approvals, live in 90 days by board order. Nobody has set a risk appetite for AI decisions or named an owner. What should the CISO do FIRST? A. Draft an AI acceptable use policy for lenders B. Have the board set risk appetite and name an owner C. Commission due diligence on the model vendor D. Require bias and explainability testing before launch (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!