During a quarterly access review, an organization discovers that several DevOps engineers have accumulated multiple privileged roles across different cloud environments due to automated provisioning workflows that never revoked old permissions. No misuse has been detected, but the roles collectively exceed least-privilege requirements and present a potential lateral-movement risk. What should the security manager do FIRST? A. Immediately disable all excessive roles and force users to request access again B. Conduct a risk analysis to understand business impact before removing permissions C. Implement just-in-time privileged access to eliminate standing permissions D. Escalate the issue to HR for potential policy violations

An enterprise discovers that a widely used third-party monitoring agent embedded in multiple production servers has begun making undocumented outbound connections to an IP range controlled by a subcontractor the enterprise has never engaged. The agent is critical for operational visibility, and disabling it would blind several detection controls. No malicious activity has been confirmed, but threat intelligence reports suggest recent supply chain compromises involving similar agents. What should the security manager do FIRST? A. Immediately isolate all hosts running the agent from the network B. Conduct a rapid supplier risk reassessment and verify the legitimacy of the subcontractor relationship C. Disable the agent across production to eliminate potential exfiltration D. Escalate directly to regulators due to potential third-party data exposure

Rymar Tech’s SOC deploys a new AI-based anomaly detection system that suddenly begins generating an unusually high volume of high-risk alerts after being retrained with third-party data the previous night. No malicious activity has been confirmed, but the alert surge is overwhelming SOC analysts and impacting monitoring effectiveness. What should the incident response manager do FIRST? A. Disable the AI platform and revert to manual triage B. Escalate to the CISO and declare a security incident C. Initiate the incident response process beginning with detection and verification D. Conduct a model validation review with the third-party integrator

A breach exposes encrypted personal data. The encryption keys are stored securely and were not compromised. Under GDPR, what is the most accurate interpretation regarding breach notification to the supervisory authority? A. Notification is always required, regardless of encryption B. Notification is not required because the data is encrypted C. Notification is required only if there is a high risk to rights and freedoms D. Notification is required only if the data subjects complain

A global enterprise adopts a strict zero-trust network architecture. All workloads—on-prem, cloud, and containerized—must mutually authenticate before communicating. To comply with regulatory requirements, the company must also maintain full packet-level visibility for threat analysis and incident response. Which solution BEST satisfies all of these requirements simultaneously? A. Deploy full end-to-end TLS between all workloads and rely on IDS/IPS to inspect only metadata and flow logs. B. Use a TLS termination proxy at network choke points and decrypt all internal traffic for inspection before re-encrypting. C. Implement mutual TLS within a service mesh that supports encrypted telemetry export and out-of-band traffic mirroring for deep packet inspection. D. Use host-based agents to perform inline decryption on each workload and send decrypted payload streams to the central IDS via secure channels.