An architect proposes implementing end-to-end encryption for all internal microservice communications. The SOC team warns this will eliminate their ability to inspect east-west traffic for lateral movement detection. Both teams escalate to you. What is the BEST course of action? A. Prioritize encryption and accept reduced network visibility as residual risk B. Reject encryption to preserve the SOC's detection capabilities C. Implement encryption with TLS termination points that allow authorized inspection D. Defer the decision until a formal threat model evaluates both risks Come back for the answer tomorrow, or study more now!

Your organization passes its annual SOC 2 Type II audit with no findings. Two months later, a penetration test reveals a critical vulnerability in a customer-facing application that has existed for over a year. The board questions why the audit missed it. What is the BEST explanation? A. The penetration testing firm used more advanced techniques than the SOC 2 auditors B. SOC 2 evaluates control design and operating effectiveness, not technical vulnerability discovery C. The audit scope was improperly defined and should have included application testing D. The auditors failed to meet professional due diligence standards Come back for the answer tomorrow, or study more now!

Your organization completes a data classification initiative and discovers that 40% of data labeled "confidential" has not been accessed in over three years. Storage costs are significant. Data owners across business units cannot confirm whether retention requirements still apply. What should you recommend FIRST? A. Archive the dormant data to lower-cost storage with existing classification labels B. Conduct a retention review with data owners and legal to validate regulatory obligations C. Declassify the unused data to reduce protection overhead and storage costs D. Implement automated data lifecycle policies to purge data exceeding retention thresholds Come back for the answer tomorrow, or study more now!

Your organization discovers that an AI-powered DNS filtering system has been silently reclassifying legitimate vendor portals as malicious, blocking procurement staff from completing time-sensitive contract renewals. Operations has been manually whitelisting domains without documentation. What should you address FIRST? A. Audit all manual whitelist entries for unauthorized or risky domain approvals B. Retune the AI classification engine to reduce vendor portal false positives C. Implement a formal exception process requiring documented approval for whitelist changes D. Revert to static DNS filtering rules until the AI system is validated Come back for the answer tomorrow, or study more now!

Your organization's AI governance committee discovers that training datasets containing customer financial records have no designated data owner. Three departments contributed data but none accepted classification responsibility. The AI model launch is scheduled in two weeks. What should you do FIRST? A. Assign the AI project manager as interim data owner to meet the launch deadline B. Escalate to senior management to assign data ownership before the model launches C. Classify the combined dataset at the highest contributing department's level D. Proceed with launch and resolve data ownership during the post-deployment review Come back for the answer tomorrow, or study more now!