A sales team built a customer portal on a low-code platform without security involvement and wants it live Monday. It holds customer contracts and nobody owns its code or data. What should the security manager do FIRST? A. Schedule a penetration test before Monday B. Move the portal into the corporate development pipeline C. Assess the portal's data, risk and ownership before release D. Require secure coding training for the sales team (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A key customer wants a site-to-site link into the plant network in 30 days so its ordering system can read live inventory. The contract is signed and the customer's security posture is unknown. What should the security manager do FIRST? A. Build the tunnel, firewall rules limited to inventory B. Assess the risk and define the connection's requirements C. Require the customer's security assessment report first D. Publish inventory through an isolated extranet segment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Finance wants a server holding ten years of contracts retired by quarter end to cut costs. No retention schedule exists and two vendor disputes are open. What should the security manager do FIRST? A. Archive everything to cloud storage, then wipe the server B. Confirm retention and legal hold needs with legal and records owners C. Have records owners delete anything older than seven years D. Cryptographically erase the drives after a verified backup (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A finance AI agent pays invoices through a shared service account with a static password. Audit is in six weeks and the CFO wants it running. What should the security manager do FIRST? A. Rotate the password and vault the credential B. Assess the account's access and assign an owner C. Replace it with per-workflow managed identities D. Have the CFO sign a risk acceptance (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A shipping app relies on an open source library whose only maintainer went silent a year ago. A critical flaw is now public and release is in two weeks. Developers want to fork and patch it. What should the security manager do FIRST? A. Approve the fork to keep the release on schedule B. Assess the library's exposure and the alternatives to forking C. Require a software bill of materials for the app D. Block the exploit at the gateway as a compensating control (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!